2704 matches found
Code injection
WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...
Design/Logic Flaw
An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...
Design/Logic Flaw
An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...
Sql injection
Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...
Sql injection
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...
Design/Logic Flaw
WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...
Design/Logic Flaw
WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...
CVE-2020-10621
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...
CVE-2020-10621
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...
CVE-2020-10619
An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...
CVE-2020-10619
CVE-2020-10619 is a relative path traversal vulnerability in Advantech WebAccess/NMS prior to 3.0.2 that lets unauthenticated attackers use a specially crafted URL to delete (and read) files outside the application's control. Multiple sources in the connected documents describe the issue as a pat...
CVE-2020-10629
WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...
CVE-2020-10629
The CVE-2020-10629 entry concerns Advantech WebAccess/NMS before 3.0.2. The vulnerability is an XML External Entity (XXE) processing flaw in XML input handling, enabling reading of sensitive files. Affected component: input processing/XML parsing inside WebAccess/NMS; root cause: improper restric...
CVE-2020-10603
WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...
CVE-2020-10603
Advantech WebAccess/NMS prior to version 3.0.2 is vulnerable to CVE-2020-10603 (OS command injection) due to improper sanitization of user input, enabling remote command execution. ZDI notes exploitation via the ManualDBBackup endpoint filename parameter, potentially with authentication bypass; c...
CVE-2020-10631
An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...
CVE-2020-10631
Advantech WebAccess/NMS (prior to version 3.0.2) is affected by CVE-2020-10631, a Relative Path Traversal vulnerability. A specially crafted URL can cause the application to delete or read files outside its intended directory, impacting confidentiality, integrity, and availability. The issue is d...
CVE-2020-10625
WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...
CVE-2020-10625
The CVE-2020-10625 entry affects Advantech WebAccess/NMS prior to 3.0.2, where an unauthenticated remote attacker can create a new administrator account due to Missing Authentication for Critical Function. This is confirmed by multiple connected sources (Red Hat advisory, ZDI, CISA ICSA, CVE reco...